When a user fails to successfully login, what information should be given back to them?

Normally, we post back "Account not found" or "Incorrect password" or "Incorrect Location" (for location restrictions). But some articles suggest it should be akin to "Login Failed. Please try again." without elucidating why it failed. Wouldn't this seem infuriating as a user?

Don’t tell me what I did wrong; Even if it seems like good user experience, it’s bad for security. I shouldn’t be able to send in a bad username or bad password and have that system tell me which information is wrong (i.e., Account not found or Password incorrect).

At what point do you compromise user experience for security?

  • 1
    You don't compromise security. If you do, because of one user you put every user in danger.
    – ThoriumBR
    Aug 29 '20 at 21:57
  • You might want to reframe the question. "At what point do you compromise user experience for security" is more likely to get opinion based answers rather than definite answers. Unless the answer acceptable to you is. It depends on you and your threat model.
    – Limit
    Aug 30 '20 at 1:09

There is no absolute security. When we are talking about security, it is important to understand what are the threats, what are the risks and what security is enough to mitigate these risks.

User permissions are bound to the user name (login name, account name). So user name is not a secret within a web site. Where as user password remains unknown even for the web site itself (assuming web site is keeping password hash only). That's why the strength of the resistance of the web site to brute-forcing depends not on the fact if user name is known to the attacker, but on the strength of the password only.

What is bad in displaying too many details in case login failed? If you display message "incorrect password", you implicitly confirm that the user name is valid. In case the web site provides online banking, the information that particular user name is registered at this web site can be used by attacker for frauds and attacks. In case the web site represents some political organization, disclosing that particular user name is registered at this web site can lead to reputational problems for particular person.

So should you always provide a very generic message? No. It depends on the context. For instance, if the web site provides some services to the members of the local bowling club and all members are known to everyone in the town, then disclosing that some user name is known (or is unknown) to the web site would not give any new information and thus will not cause any harm to the users. In this case it can make sense to display more detailed message thus providing better user experience.

In you particular case only you (or your users, your customers) can decide what is more important - security or user experience.

  • 1
    This seems overly focused on the privacy aspect of revealing that usernames are valid, compared with the protection of the web site itself. Even a local bowling club's web page is available to scans over the internet, and leaking user information simplifies (for instance) automated defacements. See eg. cheatsheetseries.owasp.org/cheatsheets/…. Also, very few real web pages are so open that it's irrelevant to all users that their status as members is obtainable by outside actors, I suspect? Aug 30 '20 at 8:30
  • 2
    @GeirEmblemsvag: Only the author can tell us how relevant is this in particular case. Only the author can estimate if there is a risk that somebody will pay much money into defacing a particular web site. There are many more cases where threats related to disclosing user names are very small, e.g. when an attack would cost the attacker much more money than benefits of successful attack. I just show that before one applies any security measures one should first understand what are the threats in the particular case and then choose appropriate countermeasures.
    – mentallurg
    Aug 30 '20 at 15:18
  • Also, for websites where users create their own accounts (i.e. most of them), the sign-up page will almost certainly disclose whether a username/email address is already registered.
    – TripeHound
    Aug 30 '20 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.